Privacy Policy

At My Health Protected Ltd, your privacy matters. We are committed to protecting your personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Financial Conduct Authority (FCA) Consumer Duty.

This Privacy Policy explains how we collect, store, use, and share your personal data when you use our services to find and manage private health insurance policies. It also outlines your legal rights and how to exercise them.

Who We Are

My Health Protected Ltd is an FCA-authorised and regulated health insurance broker offering independent advice to individuals, families, and businesses across the UK.

We help you compare health insurance quotes, find suitable insurance cover, and manage your policy throughout the year.

Our Commitment to You

We believe in transparency, fairness, and delivering good outcomes. Whether you’re seeking comprehensive medical insurance, mental health support, or family health insurance, your personal data is handled securely and ethically.

We design our services to meet your needs and provide full visibility over how your information is used.

What Personal Data We Collect

When providing a health insurance quote or managing your insurance policy, we may collect the following information:

• Full name and contact details (email, phone, address)
• Date of birth and age
• Employment and income details
• Information about family members (for joint or family policies)
• Medical history and health information, including mental health
• Details of your existing or previous health insurance plans
• Payment or financial data (e.g. card details, premium records)
• IP address and device/browser data when using our website
• Communications (phone calls, emails, online messages)

We only collect what is necessary to provide an appropriate health insurance plan tailored to your circumstances.

How We Collect Your Data

We collect personal data in several ways:

• Directly from you when you complete a form, request a quote, or contact us
• Through your use of our website or digital tools
• From insurers, medical professionals, or other parties where this is necessary and lawful
• Via cookies and analytics tools used to improve our website performance

Information We Receive From Third Parties

In addition to the information you provide to us directly, we may obtain personal data about you from carefully selected third-party sources where this is lawful.

These sources may include:

• Data providers and marketing partners
• Publicly available sources, such as Companies House or the open electoral register, where applicable
• Partner organisations where you have engaged with their services
• Insurers, introducers, or administrators involved in arranging or servicing your policy

We only work with third parties who can demonstrate that personal data has been collected and shared in compliance with applicable data protection laws, including the UK GDPR.

Categories of Personal Data We May Receive From Third Parties

The categories of personal data we may receive from third parties include:

• Title
• First name and surname
• Postal address
• Telephone number (landline and/or mobile)
• Email address
• Basic policy or enquiry information relevant to the services you have requested

If we obtain your personal data from a source other than you, UK GDPR transparency rules require us to tell you both the source of the data and the categories of personal data obtained.

Why We Use Your Data — Legal Basis

We use your personal data lawfully, based on one or more of the following:

• To perform a contract, for example to arrange, manage, or renew your insurance cover
• To comply with legal obligations, for example anti-money laundering checks or regulatory record-keeping
• For our legitimate interests, for example improving services, fraud prevention, internal training, and contacting individuals about relevant insurance services where permitted by law
• With your consent, for example marketing communications or where special category data requires explicit consent
• Where necessary for reasons of substantial public interest or to respond to regulators or authorities, where applicable

How We Use Your Information

Your data is used to:

• Compare and arrange suitable health insurance policies
• Provide advice on your insurance options and explain policy features
• Support claims handling and policy amendments
• Carry out customer service and respond to your enquiries
• Send you relevant offers, news, or renewal reminders where lawful
• Improve our website and services
• Comply with the rules set by the FCA and other authorities

We do not use your data for purposes that are incompatible with these purposes.

Sharing Your Data

We may share your personal information with:

• Leading health insurance providers such as Bupa, AXA Health, WPA, Aviva, Vitality, The Exeter and others
• Reinsurers and policy administrators
• Regulatory bodies including the FCA
• Anti-fraud and crime prevention agencies
• IT, web, hosting, and software service providers
• Our business partners where necessary to deliver your cover
• Legal advisers and professional consultants

International Transfers

If your data is transferred outside the UK or EEA, for example for secure system hosting or processing, we use appropriate safeguards such as:

• International data transfer agreements or Standard Contractual Clauses, where required
• Adequacy regulations or decisions, where applicable

This is intended to ensure your data remains protected.

How Long We Keep Your Data

We only keep your data for as long as necessary. Factors that determine this include:

• The duration of your insurance policy
• Claims handling or renewal requirements
• FCA, HMRC, or other legal and regulatory obligations
• Internal audits, complaint handling, or reporting needs

Once your data is no longer needed, we delete or anonymise it securely.

How We Protect Your Information

We use appropriate technical and organisational safeguards, including:

• Encryption during storage and transfer
• Access controls for sensitive health or payment data
• Cybersecurity tools to monitor for unauthorised access

Your information is stored on secure systems and trusted service platforms.

How We Use AI Responsibly

My Health Protected uses AI-assisted tools to support our advice process, including call transcription, fact extraction, and the generation of suitability reports and client documents. We take the protection of your personal data seriously at every stage of this process.

Call Transcription and PII Redaction

Advice calls may be transcribed to support accurate record-keeping and compliance. Transcription is carried out using AssemblyAI, with automatic personal data redaction applied at the point of transcription. The following categories of data are systematically identified and replaced with irreversible hash tokens before any transcript is stored or transmitted:

Full names, email addresses, phone numbers, dates of birth, bank account numbers and sort codes, card numbers, CVVs, and expiry dates, National Insurance numbers and other identifying number sequences.

The original personal data is never stored in our system database and cannot be recovered from the redacted transcript.

AI Document Generation — Data Minimisation

Where AI is used to extract facts or generate documents from transcripts, the system is instructed to minimise personal data further, using age bands rather than exact ages, and geographic regions rather than full addresses. No bank details, card numbers, or sensitive financial account information are present in data submitted to AI providers.

Third-Party AI Providers

We use the Anthropic Claude API to assist with document generation. Data submitted to Anthropic consists only of redacted transcripts and minimised facts.

Audio recordings submitted for transcription are processed by AssemblyAI solely for that purpose.

Audit Trail and Access Controls

All AI-assisted processing is subject to role-based access controls, session authentication, and a comprehensive audit log recording the identity, timestamp, and nature of every action taken within the system. This supports traceability in line with FCA record-keeping requirements and our obligations under UK GDPR.

Your Rights Under UK GDPR

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion where appropriate
• Restrict or object to certain types of processing
• Withdraw consent at any time where processing relies on consent
• Request portability of certain data
• Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise any of your rights, please contact us at info@myhealthprotected.co.uk.

Your Right to Complain

If you are unhappy with how we handle your personal data, we would appreciate the chance to address your concerns first. Please contact us at info@myhealthprotected.co.uk or on 0203 859 1822.

You also have the right to lodge a complaint with the Information Commissioner’s Office:

Automated Decisions and Profiling

We may use profiling or automation to:

• Assess your eligibility for certain insurance products
• Provide tailored insurance quotes
• Suggest relevant products or services

These processes are reviewed for fairness, transparency, and accuracy.

Marketing Preferences

We may send you relevant content about:

• New insurance products
• Policy updates or changes
• Health-related promotions or discounts

You can update your marketing preferences at any time by:

• Clicking “unsubscribe” in our emails
• Emailing info@myhealthprotected.co.uk
• Calling 0203 859 1822

We respect your choices and do not send unsolicited marketing in breach of the law.

Supporting Vulnerable Clients

If you are in a vulnerable situation, for example due to health, age, language, or life circumstances, please let us know. We are trained to provide extra support and tailor our communication to suit your needs.

Contact Us

If you have any questions about how we use your personal data or wish to exercise your rights, contact:

Updates to This Privacy Policy

We regularly review and update this Privacy Policy to reflect changes in the law, best practice, or business operations. Please revisit this page for the latest version.